Add SHA256 checksum validation to install script (disabled by default) (#6295)

Author: Copilot

.github/workflows/release.lock.yml

@@ -51,6 +51,19 @@ jobs:
           go_version_file: go.mod
           build_script_override: scripts/build-release.sh
 
+      - name: Upload checksums file
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          RELEASE_TAG="${GITHUB_REF#refs/tags/}"
+          if [ -f "dist/checksums.txt" ]; then
+            echo "Uploading checksums file to release: $RELEASE_TAG"
+            gh release upload "$RELEASE_TAG" dist/checksums.txt --clobber
+            echo "✓ Checksums file uploaded to release"
+          else
+            echo "Warning: checksums.txt not found in dist/"
+          fi
+
       - name: Get release ID
         id: get_release
         env:

.github/workflows/release.md

@@ -4,10 +4,28 @@
 # Supports: Linux, macOS (Darwin), FreeBSD, Windows (Git Bash/MSYS/Cygwin)
 # Usage: ./install-gh-aw.sh [version]
 # If no version is specified, it will fetch and use the latest release
+# Note: Checksum validation is currently skipped by default (will be enabled in future releases)
 # Example: ./install-gh-aw.sh v1.0.0
 
 set -e  # Exit on any error
 
+# Parse arguments
+SKIP_CHECKSUM=true  # Default to true until checksums are available in releases
+VERSION=""
+for arg in "$@"; do
+    case $arg in
+        --skip-checksum)
+            SKIP_CHECKSUM=true
+            shift
+            ;;
+        *)
+            if [ -z "$VERSION" ]; then
+                VERSION="$arg"
+            fi
+            ;;
+    esac
+done
+
 # Colors for output
 RED='\033[0;31m'
 GREEN='\033[0;32m'
@@ -50,6 +68,23 @@ if command -v jq &> /dev/null; then
     HAS_JQ=true
 fi
 
+# Check if sha256sum or shasum is available (for checksum verification)
+HAS_CHECKSUM_TOOL=false
+CHECKSUM_CMD=""
+if command -v sha256sum &> /dev/null; then
+    HAS_CHECKSUM_TOOL=true
+    CHECKSUM_CMD="sha256sum"
+elif command -v shasum &> /dev/null; then
+    HAS_CHECKSUM_TOOL=true
+    CHECKSUM_CMD="shasum -a 256"
+fi
+
+if [ "$SKIP_CHECKSUM" = false ] && [ "$HAS_CHECKSUM_TOOL" = false ]; then
+    print_warning "Neither sha256sum nor shasum is available. Checksum verification will be skipped."
+    print_warning "To suppress this warning, use --skip-checksum flag."
+    SKIP_CHECKSUM=true
+fi
+
 # Determine OS and architecture
 OS=$(uname -s)
 ARCH=$(uname -m)
@@ -167,7 +202,7 @@ fetch_release_data() {
 }
 
 # Get version (use provided version or fetch latest)
-VERSION=${1:-""}
+# VERSION is already set from argument parsing
 REPO="githubnext/gh-aw"
 
 if [ -z "$VERSION" ]; then
@@ -201,11 +236,13 @@ fi
 
 # Construct download URL and paths
 DOWNLOAD_URL="https://github.com/$REPO/releases/download/$VERSION/$PLATFORM"
+CHECKSUMS_URL="https://github.com/$REPO/releases/download/$VERSION/checksums.txt"
 if [ "$OS_NAME" = "windows" ]; then
     DOWNLOAD_URL="${DOWNLOAD_URL}.exe"
 fi
 INSTALL_DIR="$HOME/.local/share/gh/extensions/gh-aw"
 BINARY_PATH="$INSTALL_DIR/$BINARY_NAME"
+CHECKSUMS_PATH="$INSTALL_DIR/checksums.txt"
 
 print_info "Download URL: $DOWNLOAD_URL"
 print_info "Installation directory: $INSTALL_DIR"
@@ -243,6 +280,71 @@ for attempt in $(seq 1 $MAX_RETRIES); do
     fi
 done
 
+# Download and verify checksums if not skipped
+if [ "$SKIP_CHECKSUM" = false ]; then
+    print_info "Downloading checksums file..."
+    CHECKSUMS_DOWNLOADED=false
+    
+    for attempt in $(seq 1 $MAX_RETRIES); do
+        if curl -L -f -o "$CHECKSUMS_PATH" "$CHECKSUMS_URL" 2>/dev/null; then
+            CHECKSUMS_DOWNLOADED=true
+            print_success "Checksums file downloaded successfully"
+            break
+        else
+            if [ "$attempt" -eq "$MAX_RETRIES" ]; then
+                print_warning "Failed to download checksums file after $MAX_RETRIES attempts"
+                print_warning "Checksum verification will be skipped for this version."
+                print_info "This may occur for older releases that don't include checksums."
+                break
+            else
+                print_warning "Checksum download attempt $attempt failed. Retrying in 2s..."
+                sleep 2
+            fi
+        fi
+    done
+    
+    # Verify checksum if we downloaded it successfully
+    if [ "$CHECKSUMS_DOWNLOADED" = true ]; then
+        print_info "Verifying binary checksum..."
+        
+        # Determine the expected filename in the checksums file
+        EXPECTED_FILENAME="$PLATFORM"
+        if [ "$OS_NAME" = "windows" ]; then
+            EXPECTED_FILENAME="${PLATFORM}.exe"
+        fi
+        
+        # Extract the expected checksum from the checksums file
+        EXPECTED_CHECKSUM=$(grep "$EXPECTED_FILENAME" "$CHECKSUMS_PATH" | awk '{print $1}')
+        
+        if [ -z "$EXPECTED_CHECKSUM" ]; then
+            print_warning "Checksum for $EXPECTED_FILENAME not found in checksums file"
+            print_warning "Checksum verification will be skipped."
+        else
+            # Compute the actual checksum of the downloaded binary
+            ACTUAL_CHECKSUM=$($CHECKSUM_CMD "$BINARY_PATH" | awk '{print $1}')
+            
+            if [ "$ACTUAL_CHECKSUM" = "$EXPECTED_CHECKSUM" ]; then
+                print_success "Checksum verification passed!"
+                print_info "Expected: $EXPECTED_CHECKSUM"
+                print_info "Actual:   $ACTUAL_CHECKSUM"
+            else
+                print_error "Checksum verification failed!"
+                print_error "Expected: $EXPECTED_CHECKSUM"
+                print_error "Actual:   $ACTUAL_CHECKSUM"
+                print_error "The downloaded binary may be corrupted or tampered with."
+                print_info "To skip checksum verification, use: ./install-gh-aw.sh $VERSION --skip-checksum"
+                rm -f "$BINARY_PATH"
+                exit 1
+            fi
+        fi
+        
+        # Clean up checksums file
+        rm -f "$CHECKSUMS_PATH"
+    fi
+else
+    print_warning "Checksum verification skipped (--skip-checksum flag used)"
+fi
+
 # Make it executable
 print_info "Making binary executable..."
 chmod +x "$BINARY_PATH"

install-gh-aw.sh

@@ -57,3 +57,21 @@ done
 
 echo "Build complete. Binaries:"
 ls -lh dist/
+
+# Generate checksums file
+echo ""
+echo "Generating checksums..."
+cd dist
+# Use sha256sum if available (Linux), otherwise use shasum (macOS)
+if command -v sha256sum &> /dev/null; then
+  sha256sum * > checksums.txt
+elif command -v shasum &> /dev/null; then
+  shasum -a 256 * > checksums.txt
+else
+  echo "error: neither sha256sum nor shasum is available" >&2
+  exit 1
+fi
+cd ..
+
+echo "Checksums generated:"
+cat dist/checksums.txt

scripts/build-release.sh

@@ -292,5 +292,65 @@ else
     exit 1
 fi
 
+# Test 10: Verify checksum validation functionality
+echo ""
+echo "Test 10: Verify checksum validation functionality"
+
+# Check for --skip-checksum flag
+if grep -q "\-\-skip-checksum" "$PROJECT_ROOT/install-gh-aw.sh"; then
+    echo "  ✓ PASS: --skip-checksum flag is documented"
+else
+    echo "  ✗ FAIL: --skip-checksum flag not found"
+    exit 1
+fi
+
+# Check for checksum tool detection
+if grep -q "sha256sum\|shasum" "$PROJECT_ROOT/install-gh-aw.sh"; then
+    echo "  ✓ PASS: Script checks for sha256sum or shasum"
+else
+    echo "  ✗ FAIL: Script doesn't check for checksum tools"
+    exit 1
+fi
+
+# Check for checksums URL construction
+if grep -q 'CHECKSUMS_URL=.*checksums.txt' "$PROJECT_ROOT/install-gh-aw.sh"; then
+    echo "  ✓ PASS: Checksums URL is constructed"
+else
+    echo "  ✗ FAIL: Checksums URL construction not found"
+    exit 1
+fi
+
+# Check for checksum verification logic
+if grep -q "Verifying binary checksum" "$PROJECT_ROOT/install-gh-aw.sh"; then
+    echo "  ✓ PASS: Checksum verification logic exists"
+else
+    echo "  ✗ FAIL: Checksum verification logic not found"
+    exit 1
+fi
+
+# Check for checksum failure handling
+if grep -q "Checksum verification failed" "$PROJECT_ROOT/install-gh-aw.sh"; then
+    echo "  ✓ PASS: Checksum failure is handled"
+else
+    echo "  ✗ FAIL: Checksum failure handling not found"
+    exit 1
+fi
+
+# Check for graceful handling when checksums file is not available
+if grep -q "Checksum verification will be skipped" "$PROJECT_ROOT/install-gh-aw.sh"; then
+    echo "  ✓ PASS: Script handles missing checksums gracefully"
+else
+    echo "  ✗ FAIL: Missing checksums handling not found"
+    exit 1
+fi
+
+# Check for SKIP_CHECKSUM flag logic
+if grep -q "SKIP_CHECKSUM=true" "$PROJECT_ROOT/install-gh-aw.sh" && grep -q 'if \[ "\$SKIP_CHECKSUM" = false \]' "$PROJECT_ROOT/install-gh-aw.sh"; then
+    echo "  ✓ PASS: SKIP_CHECKSUM flag logic is implemented"
+else
+    echo "  ✗ FAIL: SKIP_CHECKSUM flag logic not found"
+    exit 1
+fi
+
 echo ""
 echo "=== All tests passed ==="